JVN#18593874
Installer for Rakuten Kobo Desktop Application (Windows version) may insecurely load Dynamic Link Libraries

Overview

The installer for Rakuten Kobo Desktop Application (Windows version) provided by Rakuten Kobo Inc. may insecurely load Dynamic Link Libraries.

Products Affected

• The installer for Rakuten Kobo Desktop Application (Windows version) which was distributed before 2026 July 15.

Description

The installer for Rakuten Kobo Desktop Application (Windows version) contains the following vulnerability in the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.

• Uncontrolled search path element (CWE-427)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
  • CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score 7.8
  • CVE-2026-68955

Impact

If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation.

Solution

Use the latest installer
Use the latest installer provided by the developer.

This vulnerability can only be exploited when the installer is invoked. If the product has already been installed, reinstallation is not required.